{"id":"CVE-2020-1946","aliases":["ALPINE-CVE-2020-1946","ALSA-2021:4315","DEBIAN-CVE-2020-1946","DLA-2615-1","DSA-4879-1","EUVD-2020-12752","GHSA-qmmx-pr2m-q429","MGASA-2021-0182","RHSA-2021:4315","RLSA-2021:4315","SUSE-SU-2021:1152-1","SUSE-SU-2021:1153-1","SUSE-SU-2021:1163-1","UBUNTU-CVE-2020-1946","USN-4899-1","USN-4899-2","openSUSE-SU-2021:0551-1","openSUSE-SU-2024:11395-1"],"status":"published","title":"Apache SpamAssassin has an OS Command Injection vulnerability","description":"In Apache SpamAssassin before 3.4.5, malicious rule configuration (.cf) files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA version 3.4.5, users should only use update channels or 3rd party .cf files from trusted places.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.05894,"percentile":0.93276,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-78"],"published":"2020-12-31T00:00:00Z","modified":"2026-10-29T11:01:09Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"spamassassin","fixed_in":["3.4.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"spamassassin","fixed_in":["3.4.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"spamassassin","fixed_in":["3.4.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"spamassassin","fixed_in":["3.4.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"spamassassin","fixed_in":["3.4.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"spamassassin","fixed_in":["3.4.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"spamassassin","fixed_in":["3.4.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"spamassassin","fixed_in":["3.4.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"spamassassin","fixed_in":["3.4.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"spamassassin","fixed_in":["3.4.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"spamassassin","fixed_in":["3.4.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"spamassassin","fixed_in":["3.4.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"spamassassin","fixed_in":["3.4.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"spamassassin","fixed_in":["3.4.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"spamassassin","fixed_in":["3.4.5-r0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"spamassassin","fixed_in":["3.4.4-4.el8"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"spamassassin","fixed_in":["3.4.5~pre1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"spamassassin","fixed_in":["3.4.5~pre1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"spamassassin","fixed_in":["3.4.5~pre1-1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"spamassassin","fixed_in":["3.4.2-1~deb9u4"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"spamassassin","fixed_in":["3.4.2-1+deb10u3"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"spamassassin","fixed_in":["3.4.5-1.mga7"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"spamassassin-rules","fixed_in":["3.4.5-1.mga7"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"spamassassin","fixed_in":["3.4.5-1.mga8"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"spamassassin-rules","fixed_in":["3.4.5-1.mga8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"spamassassin","fixed_in":["0:3.4.4-4.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"spamassassin-debuginfo","fixed_in":["0:3.4.4-4.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"spamassassin-debugsource","fixed_in":["0:3.4.4-4.el8"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"spamassassin","fixed_in":["0:3.4.4-4.el8"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"spamassassin","fixed_in":["3.4.2-0ubuntu0.14.04.1+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"spamassassin","fixed_in":["3.4.2-0ubuntu0.16.04.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"spamassassin","fixed_in":["3.4.2-0ubuntu0.18.04.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"spamassassin","fixed_in":["3.4.4-1ubuntu1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-4.el8"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5~pre1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5~pre1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5~pre1-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-1~deb9u4"}]}],"versions":["3.4.1-6","3.4.1-6+deb9u1","3.4.1-7","3.4.1-8","3.4.2-1~deb9u1","3.4.2-1~deb9u2","3.4.2-1~deb9u3"]},{"source":"osv","ecosystem":"Debian:10","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-1+deb10u3"}]}],"versions":["3.4.2-1","3.4.2-1+deb10u1","3.4.2-1+deb10u2"]},{"source":"osv","ecosystem":"Mageia:7","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5-1.mga7"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"spamassassin-rules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5-1.mga7"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5-1.mga8"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"spamassassin-rules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5-1.mga8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.4-4.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"spamassassin-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.4-4.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"spamassassin-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.4-4.el8"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.4-4.el8"}]}]},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5-44.13.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5-44.13.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5-44.13.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5-44.13.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5-44.13.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5-44.13.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5-44.13.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5-44.13.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5-44.13.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5-44.13.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5-44.13.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5-44.13.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5-44.13.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5-7.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5-7.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5-7.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5-7.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5-12.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP2","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5-12.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5-12.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5-12.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5-12.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5-12.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5-12.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.0","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5-12.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.0","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5-12.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 4.0","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5-12.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5-12.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-0ubuntu0.14.04.1+esm3"}]}],"versions":["3.3.2-6ubuntu2","3.3.2-8ubuntu1","3.3.2-8ubuntu2","3.4.0-1","3.4.0-1ubuntu1","3.4.0-1ubuntu2","3.4.0-1ubuntu2.1","3.4.2-0ubuntu0.14.04.1","3.4.2-0ubuntu0.14.04.1+esm1","3.4.2-0ubuntu0.14.04.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-0ubuntu0.16.04.5"}]}],"versions":["3.4.1-1","3.4.1-2","3.4.1-3","3.4.2-0ubuntu0.16.04.1","3.4.2-0ubuntu0.16.04.2","3.4.2-0ubuntu0.16.04.3","3.4.2-0ubuntu0.16.04.4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-0ubuntu0.18.04.5"}]}],"versions":["3.4.1-7","3.4.1-8","3.4.1-8build1","3.4.2-0ubuntu0.18.04.1","3.4.2-0ubuntu0.18.04.2","3.4.2-0ubuntu0.18.04.3","3.4.2-0ubuntu0.18.04.4"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-1ubuntu1.1"}]}],"versions":["3.4.2-1","3.4.2-2","3.4.3~rc6+1-1","3.4.3~rc7-1","3.4.3-1","3.4.4~rc1-1","3.4.4-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-0ubuntu0.16.04.5"}]}],"versions":["3.4.1-1","3.4.1-2","3.4.1-3","3.4.2-0ubuntu0.16.04.1","3.4.2-0ubuntu0.16.04.2","3.4.2-0ubuntu0.16.04.3","3.4.2-0ubuntu0.16.04.4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-0ubuntu0.18.04.5"}]}],"versions":["3.4.1-7","3.4.1-8","3.4.1-8build1","3.4.2-0ubuntu0.18.04.1","3.4.2-0ubuntu0.18.04.2","3.4.2-0ubuntu0.18.04.3","3.4.2-0ubuntu0.18.04.4"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-1ubuntu1.1"}]}],"versions":["3.4.2-1","3.4.2-2","3.4.3~rc6+1-1","3.4.3~rc7-1","3.4.3-1","3.4.4~rc1-1","3.4.4-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-0ubuntu0.14.04.1+esm3"}]}],"versions":["3.3.2-6ubuntu2","3.3.2-8ubuntu1","3.3.2-8ubuntu2","3.4.0-1","3.4.0-1ubuntu1","3.4.0-1ubuntu2","3.4.0-1ubuntu2.1","3.4.2-0ubuntu0.14.04.1","3.4.2-0ubuntu0.14.04.1+esm1","3.4.2-0ubuntu0.14.04.1+esm2"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5-lp152.10.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"spamassassin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.6-71.3"}]}],"bundled":9}],"products":[{"vendor":"apache","product":"spamassassin"},{"vendor":"apache software foundation","product":"apache spamassassin"},{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"}],"references":[{"url":"https://s.apache.org/3r1wh","tags":["x_refsource_MISC","x_transferred","Mailing List","Vendor Advisory","advisory"]},{"url":"https://www.debian.org/security/2021/dsa-4879","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7V2SBVTKVLFFT36ECJQ7TQ7KAQCQZDRZ/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/04/msg00000.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JFBFRIG5TX23NF4ND6OAKKY7I6TLRCCP/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NKAXYBKBMQOLIW6UKASJCAZRBOIYS4RL/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/202105-26","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-1946","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7V2SBVTKVLFFT36ECJQ7TQ7KAQCQZDRZ/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JFBFRIG5TX23NF4ND6OAKKY7I6TLRCCP/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NKAXYBKBMQOLIW6UKASJCAZRBOIYS4RL/"},{"url":"https://github.com/advisories/GHSA-qmmx-pr2m-q429"},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-1946","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2020-1946","tags":["report"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-1946","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0182.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=28673","tags":["report"]},{"url":"https://spamassassin.apache.org/news.html","tags":["web"]},{"url":"https://svn.apache.org/repos/asf/spamassassin/branches/3.4/build/announcements/3.4.5.txt","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2021/03/24/3","tags":["web","report"]},{"url":"https://access.redhat.com/errata/RHSA-2021:4315","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.5_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1943276","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4315.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-1946","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-1946","tags":["advisory","report"]},{"url":"https://errata.rockylinux.org/RLSA-2021:4315","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211152-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1159133","tags":["report"]},{"url":"https://bugzilla.suse.com/1184221","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12420","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-1946","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211153-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211163-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-1946","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4899-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-4899-2","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GXHYC7MWI2M6Y32ROZZBS5HOZOAF2HAN/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2007-0451","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-2873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15705","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11780","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11805","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-1930","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-1931","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-1946","title":"Apache SpamAssassin has an OS Command Injection vulnerability","description":"In Apache SpamAssassin before 3.4.5, malicious rule configuration (.cf) files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA version 3.4.5, users should only use update channels or 3rd party .cf files from trusted places.","status":"published","published":"2021-03-25T09:20:11Z","modified":"2025-02-13T16:27:40.012Z","cwes":["CWE-78"],"updated_at":"2026-11-02T14:35:56.213477Z"}],"euvd":[{"id":"EUVD-2020-12752","description":"In Apache SpamAssassin before 3.4.5, malicious rule configuration (.cf) files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA version 3.4.5, users should only use update channels or 3rd party .cf files from trusted places.","status":"published","published":"2021-03-25T09:20:11Z","modified":"2025-02-13T16:27:40Z","cvss":[{"version":"","score":0,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"none"}],"updated_at":"2026-11-03T00:03:53.290549Z"}],"ghsa":[{"id":"GHSA-qmmx-pr2m-q429","title":"In Apache SpamAssassin before 3.4.5, malicious rule configuration (.cf) files can be configured...","description":"In Apache SpamAssassin before 3.4.5, malicious rule configuration (.cf) files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA version 3.4.5, users should only use update channels or 3rd party .cf files from trusted places.","status":"published","published":"2022-05-24T17:45:20Z","modified":"2023-01-27T05:03:18Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:42:12.753514Z"}],"nvd":[{"id":"CVE-2020-1946","description":"In Apache SpamAssassin before 3.4.5, malicious rule configuration (.cf) files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA version 3.4.5, users should only use update channels or 3rd party .cf files from trusted places.","status":"published","published":"2021-03-25T10:15:11.727Z","modified":"2026-06-17T03:02:41.867Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:06:37.687844Z"}],"osv":[{"id":"ALPINE-CVE-2020-1946","description":"In Apache SpamAssassin before 3.4.5, malicious rule configuration (.cf) files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA version 3.4.5, users should only use update channels or 3rd party .cf files from trusted places.","status":"published","published":"2021-03-25T10:15:11.727Z","modified":"2026-10-26T11:17:55.14611498Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:27:48.11886Z"},{"id":"CVE-2020-1946","description":"In Apache SpamAssassin before 3.4.5, malicious rule configuration (.cf) files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA version 3.4.5, users should only use update channels or 3rd party .cf files from trusted places.","status":"published","published":"2021-03-25T10:15:11.727Z","modified":"2026-10-24T10:30:25.505474577Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:15.212689Z"},{"id":"DEBIAN-CVE-2020-1946","description":"In Apache SpamAssassin before 3.4.5, malicious rule configuration (.cf) files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA version 3.4.5, users should only use update channels or 3rd party .cf files from trusted places.","status":"published","published":"2021-03-25T10:15:11.727Z","modified":"2026-10-26T12:02:29.248021817Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:33.384087Z"},{"id":"RHSA-2021:4315","title":"Red Hat Security Advisory: spamassassin security update","status":"published","published":"2024-09-16T06:13:10Z","modified":"2025-11-22T12:26:33Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RLSA-2021:4315","title":"Moderate: spamassassin security update","description":"The SpamAssassin tool provides a way to reduce unsolicited commercial email (spam) from incoming email.\n\nSecurity Fix(es):\n\n* spamassassin: Malicious rule configuration files can be configured to run system commands (CVE-2020-1946)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.5 Release Notes linked from the References section.","status":"published","published":"2021-11-09T08:58:53Z","modified":"2026-02-05T14:15:11.017084Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2020-1946","description":"In Apache SpamAssassin before 3.4.5, malicious rule configuration (.cf) files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA version 3.4.5, users should only use update channels or 3rd party .cf files from trusted places.","status":"published","published":"2020-12-31T00:00:00Z","modified":"2026-02-04T02:52:01.238273Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:23.344108Z"},{"id":"ALSA-2021:4315","title":"Moderate: spamassassin security update","description":"The SpamAssassin tool provides a way to reduce unsolicited commercial email (spam) from incoming email.\n\nSecurity Fix(es):\n\n* spamassassin: Malicious rule configuration files can be configured to run system commands (CVE-2020-1946)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2021-11-09T08:58:53Z","modified":"2026-10-29T11:01:09.408583215Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"DLA-2615-1","title":"spamassassin - security update","status":"published","published":"2021-04-02T00:00:00Z","modified":"2026-03-09T01:20:52.523757Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"DSA-4879-1","title":"spamassassin - security update","status":"published","published":"2021-03-27T00:00:00Z","modified":"2026-03-09T02:11:33.524399Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"MGASA-2021-0182","title":"Updated spamassassin packages fix security vulnerability","description":"In Apache SpamAssassin before 3.4.5, malicious rule configuration (.cf) files\ncan be configured to run system commands without any output or errors. With\nthis, exploits can be injected in a number of scenarios. In addition to upgrading\nto SA version 3.4.5, users should only use update channels or 3rd party .cf\nfiles from trusted places. (CVE-2020-1946)\n","status":"published","published":"2021-04-12T19:59:59Z","modified":"2026-04-16T04:42:09.216472845Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2021:0551-1","title":"Security update for spamassassin","description":"This update for spamassassin fixes the following issues:\n\n- CVE-2019-12420: memory leak via crafted messages (bsc#1159133)\n- CVE-2020-1946: security update (bsc#1184221)\n\nThis update was imported from the SUSE:SLE-15-SP1:Update update project.","status":"published","published":"2021-04-14T14:51:27Z","modified":"2026-02-04T03:10:16.152823Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2024:11395-1","title":"perl-Mail-SpamAssassin-3.4.6-71.3 on GA media","description":"These are all security issues fixed in the perl-Mail-SpamAssassin-3.4.6-71.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:16:54.806419Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2021:1152-1","title":"Security update for spamassassin","description":"This update for spamassassin fixes the following issues:\n\n- spamassassin was updated to version 3.4.5\n- CVE-2019-12420: memory leak via crafted messages (bsc#1159133)\n- CVE-2020-1946: security update (bsc#1184221)\n","status":"published","published":"2021-04-12T16:18:52Z","modified":"2026-02-04T03:38:33.410652Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:1153-1","title":"Security update for spamassassin","description":"This update for spamassassin fixes the following issues:\n\n- CVE-2019-12420: memory leak via crafted messages (bsc#1159133)\n- CVE-2020-1946: security update (bsc#1184221)\n","status":"published","published":"2021-04-12T16:19:55Z","modified":"2026-02-04T02:58:34.274927Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:1163-1","title":"Security update for spamassassin","description":"This update for spamassassin fixes the following issues:\n\n- CVE-2019-12420: memory leak via crafted messages (bsc#1159133)\n- CVE-2020-1946: security update (bsc#1184221)\n","status":"published","published":"2021-04-13T11:43:13Z","modified":"2025-05-02T04:30:03.907412Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"USN-4899-1","title":"spamassassin vulnerability","description":"Damian Lukowski discovered that SpamAssassin incorrectly handled certain CF\nfiles. If a user or automated system were tricked into using a specially-\ncrafted CF file, a remote attacker could possibly run arbitrary code.\n","status":"published","published":"2021-04-01T12:00:50Z","modified":"2026-02-10T04:42:07Z","updated_at":"2026-11-02T16:58:15.159055Z"},{"id":"USN-4899-2","title":"spamassassin vulnerability","description":"USN-4899-1 fixed a vulnerability in SpamAssassin. This update provides\nthe corresponding update for Ubuntu 14.04 ESM.\n\nOriginal advisory details:\n\n Damian Lukowski discovered that SpamAssassin incorrectly handled certain CF\n files. If a user or automated system were tricked into using a specially-\n crafted CF file, a remote attacker could possibly run arbitrary code.\n","status":"published","published":"2021-04-12T12:21:53Z","modified":"2026-02-10T04:42:07Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}